ossec · ddpbsd · Mar 17, 2021 · Mar 17, 2021 · Mar 17, 2021 · Mar 17, 2021
diff --git a/docs/syntax/agent_config.trst b/docs/syntax/agent_config.trst
@@ -1,27 +1,27 @@
-.. xml:element:: agent_config_options
+- agent_config_options
 
 
-.. xml:element:: agent_config
+- agent_config
 
     Defines the beginning or end of an agent configuration block.
 
 
 
-    .. xml:element:: name
+    - name
 
     This option to ``agent_config`` allows you to assign the block the one particular agent by using the agent's name.
 
     **Example:** <agent_config name="agent007">
 
-    .. xml:element:: os
+    - os
 
     This option to ``agent_config`` allows you to assign the block to an operating system.
 
     **Example:** <agent_config os="Windows">
 
     **Allowed:** Any OS family (Windows, Linux, OpenBSD, etc.)
 
-    .. xml:element:: profile
+    - profile
 
     This option to ``agent_config`` allows you to assign a profile name to the the block. Any agent may use this block if it is configured to use the defined profile.
 

diff --git a/docs/syntax/decoders.trst b/docs/syntax/decoders.trst
@@ -1,4 +1,4 @@
-.. xml:element:: decoder 
+- decoder 
 
    Each decoder must have its name defined for reference by rules and other decoders.
 
@@ -12,7 +12,7 @@
 
      <decoder name="atomic-widget">
 
-.. xml:element:: decoder.parent
+- decoder.parent
 
    A decoder may be the child of another decoder, offering further parsing.
    The child decoders will not be checked if the parent does not match the log message.
@@ -24,7 +24,7 @@
      <decoder name="atomic-widget-login">
        <parent>atomic-widget</parent>
 
-.. xml:element:: decoder.accumulate
+- decoder.accumulate
 
    .. versionadded:: 2.9.0
 
@@ -42,7 +42,7 @@
 
      Requires a regex populating the ``id`` field using `regex` or `pcre2`.
 
-.. xml:element:: decoder.program_name 
+- decoder.program_name 
 
    For many log messages a program name can be extracted automatically.
    This option compares the value with the decoded `program_name` value.
@@ -56,40 +56,40 @@
       <decoder name="atomic-widget">
         <program_name>atomic-widget</program_name>
 
-.. xml:element:: decoder.program_name_pcre2
+- decoder.program_name_pcre2
 
    For many log messages a program name can be extracted automatically.
    This option compares the value with the decoded `program_name` value.
 
    **Allowed:** A pcre2 compliant string to match the `program_name`.
 
-.. xml:element:: decoder.prematch 
+- decoder.prematch 
 
    `prematch` looks for a string to determine whether the decoder is applicable.
 
    **Allowed:** Any :ref:`os_match`
 
-.. xml:element:: decoder.prematch_pcre2
+- decoder.prematch_pcre2
 
    `prematch` uses pcre2 to look for a string to determine whether the decoder is applicable.
 
    **Allowed:** A pcre2 compliant string.
 
-.. xml:element:: decoder.regex 
+- decoder.regex 
 
    This option will allow parts of the log messages to be extracted into fields defined in the `order` option,
    using the OSSEC regex syntax.
 
    **Allowed:** Any :ref:`os_regex`
 
-.. xml:element:: decoder.pcre2
+- decoder.pcre2
 
    This option will allow parts of the log messages to be extracted into fields defined in the `order` option,
    using the PCRE2 syntax.
 
    **Allowed:** A pcre2 compliant search string.
 
-.. xml:element:: decoder.order 
+- decoder.order 
 
    This option names the fields used by the `regex` or `pcre2` options.
    The field names are comma separated.
@@ -125,7 +125,7 @@
       - filename
 
 
-.. xml:element:: decoder.fts
+- decoder.fts
 
    `fts` is the First Time Seen option inside of analysisd.
    It will alert the first time any defined decoded field is populated with a new value.
@@ -142,7 +142,7 @@
         <order>srcuser</order>
         <fts>srcuser</fts>
 
-.. xml:element:: decoder.ftscomment 
+- decoder.ftscomment 
 
    Unused at this time. 
 
diff --git a/docs/syntax/internal_options.agent.trst b/docs/syntax/internal_options.agent.trst
@@ -1,8 +1,8 @@
 .. _agent:
 
-.. OS:intopt:: agent.debug
+   - agent.debug
 
-    Run the agent's processes in debug mode.
+      Run the agent's processes in debug mode.
 
-    **Default:** 0
+      **Default:** 0
 
diff --git a/docs/syntax/internal_options.analysisd.trst b/docs/syntax/internal_options.analysisd.trst
@@ -1,51 +1,51 @@
 .. _analysisd:
 
-.. OS:intopt:: analysisd.default_timeframe 
+   - analysisd.default_timeframe 
 
-    Analysisd default rule timeframe
+       Analysisd default rule timeframe
 
-    **Default:** 360 
+       **Default:** 360 
 
-    **Allowed:** Any integer 
+       **Allowed:** Any integer 
 
-.. OS:intopt:: analysisd.stats_maxdiff
+   - analysisd.stats_maxdiff
 
-    **Default:** 25000
+       **Default:** 25000
 
-    **Allowed:** Any integer 
+       **Allowed:** Any integer 
 
-.. OS:intopt:: analysisd.stats_mindiff
+   - analysisd.stats_mindiff
 
-    **Default:** 250
+       **Default:** 250
 
-    **Allowed:** Any integer 
+       **Allowed:** Any integer 
 
-.. OS:intopt:: analysisd.stats_percent_diff
+   - analysisd.stats_percent_diff
 
-    **Default:** 30
+       **Default:** 30
 
-    **Allowed:** Any integer 
+       **Allowed:** Any integer 
 
-.. OS:intopt:: analysisd.fts_list_size
+   - analysisd.fts_list_size
 
-    **Default:** 32
+       **Default:** 32
 
-    **Allowed:** Any integer 
+       **Allowed:** Any integer 
 
-.. OS:intopt:: analysisd.fts_min_size_for_str
+   - analysisd.fts_min_size_for_str
 
-    **Default:** 14
+       **Default:** 14
 
-    **Allowed:** Any integer 
+       **Allowed:** Any integer 
 
-.. OS:intopt:: analysisd.log_fw
+   - analysisd.log_fw
 
-    **Default:** 1
+       **Default:** 1
 
-    **Allowed:** Any integer 
+       **Allowed:** Any integer 
 
-.. OS:intopt:: analysisd.debug
+   - analysisd.debug
 
-    **Default:** 0
+       **Default:** 0
 
-    **Allowed:** Any integer 
+       **Allowed:** Any integer 
diff --git a/docs/syntax/internal_options.dbd.trst b/docs/syntax/internal_options.dbd.trst
@@ -1,7 +1,7 @@
 .. _dbd:
 
-.. OS:intopt:: dbd.reconnect_attempts
+   - dbd.reconnect_attempts
 
-    The number of times ``ossec-dbd`` will attempt to reconnect to the database.
+       The number of times ``ossec-dbd`` will attempt to reconnect to the database.
 
-    **Default:** 10
+       **Default:** 10
diff --git a/docs/syntax/internal_options.logcollector.trst b/docs/syntax/internal_options.logcollector.trst
@@ -1,24 +1,24 @@
 .. _logcollector:
 
-.. OS:intopt:: logcollector.loop_timeout
+   - logcollector.loop_timeout
 
-    **Default:** 2
+       **Default:** 2
 
-.. OS:intopt:: logcollector.open_attempts
+   - logcollector.open_attempts
 
-    **Default:** 8
+       **Default:** 8
 
-.. OS:intopt:: logcollector.remote_commands=0
+   - logcollector.remote_commands=0
 
-    Allow the agents to run commands defined in ``agent.conf``.
+       Allow the agents to run commands defined in ``agent.conf``.
 
-    **Allowed:** 0,1
+       **Allowed:** 0,1
 
-    **Default:** 0
+       **Default:** 0
 
-    .. note::
+       .. note::
 
-        This option first appeared in OSSEC 2.7.
+           This option first appeared in OSSEC 2.7.
 
 
 
diff --git a/docs/syntax/internal_options.maild.trst b/docs/syntax/internal_options.maild.trst
@@ -1,32 +1,32 @@
 .. _maild:
 
-.. OS:intopt:: maild.strict_checking
+   - maild.strict_checking
 
 
-    **Default:** 1
+       **Default:** 1
 
-    **Allowed:** 0 or 1
+       **Allowed:** 0 or 1
 
-.. OS:intopt:: maild.groupping
+   - maild.groupping
 
-    If set to ``1`` alerts will be grouped together in one email. These alerts may be of different types or levels, and may be from different systems.
+       If set to ``1`` alerts will be grouped together in one email. These alerts may be of different types or levels, and may be from different systems.
 
-    **Default:** 1
+       **Default:** 1
 
-    **Allowed:** 0 or 1
+       **Allowed:** 0 or 1
 
-.. OS:intopt:: maild.full_subject
+   - maild.full_subject
 
-    If set to ``1`` maild will use a full subject when sending alert emails. If set to ``0`` the subject is shortened.
+       If set to ``1`` maild will use a full subject when sending alert emails. If set to ``0`` the subject is shortened.
 
-    **Default:** 0
+       **Default:** 0
 
-    **Allowed:** 0 or 1
+       **Allowed:** 0 or 1
 
-.. OS:intopt:: maild.geoip
+   - maild.geoip
 
-    If set to ``1`` mails will display GeoIP data in alert emails.
+       If set to ``1`` mails will display GeoIP data in alert emails.
 
-    **Default:** 1
+       **Default:** 1
 
-    **Allowed:** 0 or 1
+       **Allowed:** 0 or 1
diff --git a/docs/syntax/internal_options.monitord.trst b/docs/syntax/internal_options.monitord.trst
@@ -1,30 +1,29 @@
-.. monitord:
+.. _monitord:
 
-.. OS:intopt:: monitord.day_wait
 
-    Amount of time OSSEC will wait before compressing/signing log files.
+   - monitord.day_wait
 
-    **Default:** 10
+       Amount of time OSSEC will wait before compressing/signing log files.
 
-.. OS:intopt:: monitord.compress
+       **Default:** 10
 
-    If set to ``1`` ``ossec-monitord`` will compress old log files.
+   - monitord.compress
 
-    **Default:** 1
+       If set to ``1`` ``ossec-monitord`` will compress old log files.
 
-    **Available:** 0 or 1
+       **Default:** 1
 
-.. OS:intopt:: monitord.sign
+       **Available:** 0 or 1
 
-    If set to ``1`` ``ossec-monitord`` will sign old log files.
+   - monitord.sign
 
-    **Default:** 1
+       If set to ``1`` ``ossec-monitord`` will sign old log files.
 
-.. OS:intopt:: monitord.monitor_agents
+       **Default:** 1
 
-
-
-    **Default:** 1
+   - monitord.monitor_agents
 
+
 
+       **Default:** 1
 
diff --git a/docs/syntax/internal_options.remoted.trst b/docs/syntax/internal_options.remoted.trst
@@ -1,17 +1,17 @@
 .. _remoted:
 
-.. OS:intopt:: remoted.recv_counter_flush
+   - remoted.recv_counter_flush
 
-    **Default:** 128
+       **Default:** 128
 
-.. OS:intopt:: remoted.comp_average_printout
+   - remoted.comp_average_printout
 
-    **Default:** 19999
+       **Default:** 19999
 
-.. OS:intopt:: remoted.verify_msg_id
+   - remoted.verify_msg_id
 
-    **Default:** 1
+       **Default:** 1
 
-.. OS:intopt:: remoted.debug
+   - remoted.debug
 
-    **Default:** 0
+       **Default:** 0